Scenario Interview Questions — All Categories
92 questions across 28 categories
Open-ended, realistic situations that combine multiple technologies and force genuine engineering judgment.
How would you migrate a cluster from one CNI plugin to another without a full cluster rebuild — what's actually risky about it?
ExpertKubernetes8 min
A security team rejects a pod spec requesting privileged: true — what SecurityContext alternatives would you propose to meet the actual requirement?
AdvancedKubernetes7 min
A pod's ServiceAccount token was found in a public repo — what's your incident response, and how do you reduce blast radius for next time?
ExpertKubernetes8 min
How would you design least-privilege RBAC for a CI/CD pipeline that deploys to multiple namespaces, without granting cluster-admin?
AdvancedKubernetes8 min
A Pod Security Standard (restricted) rejects a legacy workload that needs to run as root — how do you handle this without disabling the standard cluster-wide?
AdvancedKubernetes7 min
How would you dedicate a set of nodes exclusively to one team's workloads, while still letting that team's pods run elsewhere too?
AdvancedKubernetes7 min
A CSI driver upgrade causes new attach operations to fail while already-mounted volumes keep working — how do you investigate, and how would you roll this out more safely next time?
ExpertKubernetes8 min
A team deletes a PVC expecting the data gone, but it's later recovered from the underlying disk — why, and how should reclaim policy be chosen deliberately?
IntermediateKubernetes6 min
A production workload needs persistent storage, and its pods may be rescheduled to different nodes — how do you design storage so data survives that?
BeginnerKubernetes6 min
A CronJob has been silently creating thousands of failed Jobs over several days — how did this happen, and how would you prevent it?
AdvancedKubernetes7 min
How would you design a Job for a task that must never run twice, even if a pod fails partway through (e.g., a billing charge)?
ExpertKubernetes8 min
How would you safely roll out a breaking change to a DaemonSet running a critical node-level agent across a large production cluster?
AdvancedKubernetes7 min
How would you set an initial SLO for a service that has no historical performance data to base it on at all?
IntermediateSRE6 min
How would you handle an SLO breach caused by a shared dependency affecting multiple services at once?
AdvancedSRE7 min
A team has started ignoring alerts because most of them turn out to be noise — how do you diagnose and fix alert fatigue systematically?
AdvancedPrometheus8 min
How would you choose the right SLIs for a new service, rather than defaulting to generic latency and error rate for everything?
AdvancedPrometheus7 min
During an incident spanning multiple services, how would you quickly correlate metrics across them to find where the problem actually originates?
AdvancedPrometheusGrafana8 min
How would you retrofit distributed tracing into a system with no existing context propagation, without a disruptive big-bang migration?
AdvancedOpentelemetry8 min
How do you handle a team that has a legitimate reason to deviate from a golden path — what does a good exception process actually look like?
IntermediatePlatform Engineering6 min
How would you sunset or retire a golden path that's no longer the right default as the organization's needs have evolved?
AdvancedPlatform Engineering7 min
How do you decide what belongs on a golden path / internal developer platform versus what teams should just be free to do themselves?
AdvancedPlatform Engineering8 min
Usage data shows one of your platform's supported deployment strategies is used by exactly two teams out of sixty, but maintaining it still consumes real platform-team time. How do you handle deprecating it?
IntermediatePlatform Engineering6 min
How would you handle a data transformation that genuinely needs to see the whole dataset at once, like a global sort, when streaming isn't an option?
AdvancedPython8 min
You find a piece of a legacy pipeline that seems actively dangerous — overly broad credentials, say — but nobody can explain why it's configured that way. What do you do?
AdvancedSecurity7 min